Regulator rulings

Enforcement

1,191 decisions · decided, newest first· j k to navigate

Feed live· newest 13d

Supervisory-authority rulings on data-breach cases — EU/EEA + UK GDPR decisions citing Articles 32–34, aggregated from GDPRhub, a noyb project, and Singapore PDPA decisions published by the PDPC. A ruling is a regulator's decision after the fact — not a breach notification. Fines are shown as filed, in the regulator's currency. For the underlying breach filings, see Disclosures.

Decisions1,1912018 – presentnot filtered

Violation found54%640 decisionsnot filtered Largest fine€251,000,000Meta Platforms Ireland Limited · DPC · as filed

Most activeUnknown512 decisions · supervisory authoritynot filtered

SortDecided · newest first Decided · oldest firstWindow7d 30d 90d

OutcomeViolation found640 No violation31 Upheld

DecisionRegulatorOutcomeFine · as filedDecided

Aug 5, 20262 rows

NYA Tuition Pte LtdBackground The Personal Data Protection Commission (the “Commission”) received complaints from two individuals regarding the receipt of unsolicited marketing messages (“specified messages”) sent by NYA Tuition Pte. Ltd. (the “Organisation”). The Organisation had continued to send specified messages to the two complainants even after acknowledging their respective withdrawal requests for the Organisation to cease sending such messages (the “Incident”). The specified messages did not include proper sender identification and contact information as required under section 44 of the Personal Data Protection Act 2012 (the “PDPA”). The First Complainant received a specified message from the Organisation on 24 May 2024 despite having previously withdrawn consent to receiving such messages in March 2022, and despite the Organisation’s previous confirmations of the withdrawal of consent and removal of the First Complainant’s number from its database. The First Complainant’s number has been registered with the Do Not Call registry since April 2022. The Second Complainant received six specified messages from the Organisation between August 2022 and December 2024, despite having explicitly withdrawn consent to receiving such messages multiple times between August 2022 and June 2024. The Organisation had confirmed the withdrawal of consent and removal of the Second Complainant’s number from its database in January 2023, and again in June 2024. The Second Complainant’s number has been registered with the Do Not Call registry since December 2013. However, the Second Complainant continued to receive specified messages from the Organisation at the same number. In respect of both Complainants, the Organisation did not act as required under section 47(3) of the PDPA. The Organisation also did not check the Do Not Call register as required under section 43(1) of the PDPA, before sending th